General
- Target 2026-04-17_8158e0edc078e97051258024b33cf4ac_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee
- Size 1.2MB
- Sample260417-d7dkraev3p
- SHA256 8e229f713adb69cb78d60bd33daca8d3294426d4ddefe6721bb7e50d3482273d
- MD5 8158e0edc078e97051258024b33cf4ac
- SHA1 4bb7d3c59833ba5e2bb28f62b41abf07248a9d7f
- SHA512 49c71fbb55b6220b0ccad6b824efc59627120233b0f4c7684bfd872d2758447c6fc9717161d1c1a0f0e178192d60947afa50660a2d294c82c463bae3f8b434a9
- SSDEEP 12288:AwKfOVRo9yRYCi6P4O8b8ITDnlC0iBoK+DXVak50:AxWVeyRYWP4O8b8ITDnlimKaZ0
- TLSH T1BC45B525A7E88614F1BB7B309DB546A42A277C51AE75C78F36443F4E3B70A60CD22723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-17_8158e0edc078e97051258024b33cf4ac_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-17_8158e0edc078e97051258024b33cf4ac_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee.exe
Resource
win11-20260130-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-17_8158e0edc078e97051258024b33cf4ac_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee
- Size 1.2MB
- SHA256 8e229f713adb69cb78d60bd33daca8d3294426d4ddefe6721bb7e50d3482273d
- MD5 8158e0edc078e97051258024b33cf4ac
- SHA1 4bb7d3c59833ba5e2bb28f62b41abf07248a9d7f
- SHA512 49c71fbb55b6220b0ccad6b824efc59627120233b0f4c7684bfd872d2758447c6fc9717161d1c1a0f0e178192d60947afa50660a2d294c82c463bae3f8b434a9
- SSDEEP 12288:AwKfOVRo9yRYCi6P4O8b8ITDnlC0iBoK+DXVak50:AxWVeyRYWP4O8b8ITDnlimKaZ0
- TLSH T1BC45B525A7E88614F1BB7B309DB546A42A277C51AE75C78F36443F4E3B70A60CD22723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory